PT-2024-15537 · Deshang · Deshang Dscms

Glzjin · Published 2024-01-11 · Updated 2024-05-17 · CVE-2024-0414

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions DeShang DSCMS versions up to 3.1.2/7.1

Description A vulnerability has been found in DeShang DSCMS, affecting an unknown function of the file public/install.php. The manipulation leads to improper access controls. It is possible to launch the attack remotely. The exploit has been disclosed to the public and may be used.

Recommendations For DeShang DSCMS versions up to 3.1.2/7.1, consider restricting access to the public/install.php file until a patch is available. As a temporary workaround, consider disabling unknown functions in the public/install.php file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

CVE-2024-0414

Affected Products

Deshang Dscms

References · 9

• 🔥 https://note.zhaoj.in/share/xYQMsARg83ui · Exploit
• https://osv.dev/vulnerability/CVE-2024-0414 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-0414 · Security Note
• https://vuldb.com/?id.250434 · Note
• https://t.me/cvenotify/67917 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1745530492789670222 · Twitter Post
• https://t.me/cvenotify/67222 · Telegram Post
• https://vuldb.com/?ctiid.250434 · Note
• https://twitter.com/CVEnew/status/1745494426057642186 · Twitter Post